CVE-2026-91781: GNU Binutils null pointer dereference in ELF section handler

CVE-2026-91781 · Severity: low · CVSS 3.3 · Published 2026-09-15

GNU Binutils is a set of tools used by developers to manipulate binary executable files. A null pointer dereference vulnerability in the ELF section handler can cause the linker to crash when processing malformed object files during relocation linking. An attacker with the ability to supply crafted binary files could trigger a denial of service by crashing the build process.

Technologies: Gnu Binutils. Vendors: Gnu.

Quick answers

Is CVE-2026-91781 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-91781 being exploited in the wild.
How severe is CVE-2026-91781?
Low severity, with a CVSS score of 3.3, published 15 September 2026.
Which products and versions are affected?
Gnu Binutils 2.47.
Is there a fix for CVE-2026-91781?
A patch was published on 2026-08-04: Patch committed to master branch (commit 7322e9bc30cb282575a701c307851fd3d66fee68) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91781 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-91781?
Check whether you run Gnu Binutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a null pointer dereference in the elf_x86_64_common_section_index function (bfd/elf64-x86-64.c:6093) that occurs when the linker processes common symbols during relocatable linking (-r flag). The vulnerable code dereferences a NULL sec pointer and calls elf_section_flags on it without validation. The attack requires local access and the ability to provide a specially crafted object file (PoC available) to the linker. An attacker can trigger a segmentation fault (SEGV) that crashes the linking process. The vulnerability has been patched in binutils 2.48 via commit 7322e9bc30cb282575a701c307851fd3d66fee68.

Affected products

  • GNU Binutils 2.47

Timeline

  • 2026-07-28: disclosed: Vulnerability reported to Sourceware Bugzilla
  • 2026-08-04: patched: Patch committed to master branch (commit 7322e9bc30cb282575a701c307851fd3d66fee68)
  • 2026-09-15: advisory: CVE-2026-91781 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.